# Honen.com — autoreg, MCP sandbox, OpenAI-compatible gateway (live 2026-10-13)

Honen.com = AI course-builder platform (StudyFetch family). Free tier per account:
`aiMessagesPerMonth: 15`, `fastBuildsPerMonth: 1`. Farm + gateway are the working
value path; the Pro trial ($20/mo, 7 days free) is card-only and hits the UA 3DS
wall — see `payment-hitter` §14 (requires_action on generated AND real UA Visa).

## Toolkit

`C:/Users/User/tmp/honen_toolkit/` (stdlib-only, Python311, `PYTHONPATH=""`):
- `honen_api.py` — client: signup/login, workspace, onboarding, usage, billing,
  assistant chat (SSE, AI SDK v5 parser `parse_ai_stream`), MCP token + JSON-RPC,
  `provision_account(email, pwd, name)` = full sequence in one call.
- `honen_farm.py N` — mass-register → `accounts.jsonl` + `used_emails.txt`.
  Proven: 5/5 OK, ~2.7 s/account.
- `gateway.py` — local OpenAI-compat gateway :8600 over the account pool;
  models `honen-assistant`, `honen-sandbox`.
- `honen_hit.py IDX` — Stripe trial hitter (camoufox); `HONEN_CARD` env accepts a
  single-card JSON override `{"number","exp","cvv","name"}`.

## Auth + provisioning (no captcha, no email verification)

1. `POST /api/auth/signup {email, password, name}` — Gmail `+alias` works.
   Session cookie: `courses_session`.
2. Session check is `GET /api/auth/session` — **POST returns 405** (this broke
   provisioning until fixed).
3. `POST /api/workspaces/create-personal` → workspaceId.
4. `POST /api/user/onboarding` — `profileData` fields: `ageRange`, `education`,
   `howDidYouHear`, `useCase`, `complete: true` (exact step IDs live in the
   onboarding JS chunk).
5. `POST /api/billing/usage/get {workspaceId}` → free-tier counters.

## Chat / course APIs (all POST, cookie auth)

- `/api/workspace-assistant/chat` — SSE stream; optional `sessionId` from
  `/api/workspace-assistant/sessions/list`; builds courses from a prompt.
- `/api/courses/editor-chat` — SSE with tool-call events (toolName/input/output).
- `/api/chat` with `chatType=course-builder` + courseId.
- `/api/courses/draft/create` — `{title, contentType:"course"}` → courseId.

## MCP endpoint (sandboxed code execution)

- `POST /api/mcp/token` → `data.token` (bearer). Store the FULL token — copying
  from truncated tool output breaks auth.
- Endpoint: `POST /api/mcp/mcp` (JSON-RPC 2.0); server `honen-generic-mcp v2.0.0`;
  discovery also at `/.well-known/mcp`.
- `tools/call workspace_assistant` executes bash in a sandbox (`python3`, `node`
  available) — this is what the `honen-sandbox` gateway model exposes.

## Billing / trial recon

- `POST /api/billing/plans/list`; Pro MONTHLY: planId `69a53eb4dca341fccc3f3119`,
  stripePriceId `price_1T6R4iE31dJRVM9vkdkvWjrd`; TEAM planId
  `69c57f7f752c550003109fdf` (seatCount param).
- `POST /api/billing/subscription/checkout {planId, interval, stripePriceId,
  workspaceId}` → `checkoutUrl` — SINGLE-USE Stripe `cs_live` URL, regenerate per
  attempt.
- `POST /api/billing/coupon/validate` — ~35 codes probed, 0 valid; no coupon
  literals in JS bundles.
- Checkout accepts Card only (no SEPA/ACH); UAH currency from UA IP.
- Verdict: trial = SetupIntent; UA cards (generated mono BIN AND real Visa)
  attach as payment_method then stall at `requires_action` (3DS). Automation is a
  dead end; manual handoff (user completes 3DS in bank app) or non-UA VCC are the
  only paths — full decision order in `payment-hitter` §14.

## Reverse-engineering notes

- `GET /openapi.json` is public — full API map without auth.
- Next.js chunk grep (`/api/...` extraction) across onboarding/create-course/
  build/edit pages yields the complete endpoint set; SSE transport strings
  (`DefaultChatTransport`) reveal chat payload shapes.
- `raw=True` responses must NOT have their body consumed before returning —
  reading it breaks SSE streaming for the caller.